ci: pin actions to SHAs and gate workflows on actionlint + zizmor

Pins every action to the latest release SHA within its current major, so
no untested major bump rides along: checkout v4.4.0, setup-go v5.6.0,
upload-artifact v4.6.2, download-artifact v4.3.0, action-gh-release v2.6.2.

Adds a `workflows` CI job running actionlint and zizmor. actionlint comes
from `go install` (module proxy checksums cover integrity); zizmor has no
published checksums, so its release tarball is pinned by version and
verified against a recorded sha256. The gate uses --min-severity=low, which
fails on low and above while tolerating the one informational
superfluous-actions advisory.

zizmor only collects from .github/workflows: pointing it at .gitea/workflows
yields "no inputs collected", and when both directories are passed it audits
only .github and still exits 0. The gate therefore passes explicit *.yml
paths, which is the only form that actually audits the Gitea workflows.

Auditing them for the first time surfaced seven findings, now fixed:
credential persistence on checkout (persist-credentials: false), setup-go
caching on the release path (cache: false), and missing top-level
permissions (contents: read, with contents: write narrowed to the GitHub
release job that needs it).

.gitea/workflows/ci.yml

@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [main]
@@ -8,7 +11,8 @@ on:
       - 'go.mod'
       - 'go.sum'
       - 'Makefile'
-      - '.gitea/workflows/ci.yml'
+      - '.gitea/workflows/**'
+      - '.github/workflows/**'
   pull_request:
     branches: [main]
     paths:
@@ -16,7 +20,8 @@ on:
       - 'go.mod'
       - 'go.sum'
       - 'Makefile'
-      - '.gitea/workflows/ci.yml'
+      - '.gitea/workflows/**'
+      - '.github/workflows/**'
 
 jobs:
   build:
@@ -24,12 +29,15 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: '1.25'
+          cache: false
 
       - name: Format check
         run: |
@@ -48,3 +56,45 @@ jobs:
 
       - name: Static build
         run: CGO_ENABLED=0 go build -ldflags="-w -s" -o shush ./cmd/shush
+
+  workflows:
+    runs-on: cpu
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version: '1.25'
+          cache: false
+
+      - name: Install actionlint
+        run: go install github.com/rhysd/actionlint/cmd/[email protected]
+
+      - name: Install zizmor
+        env:
+          ZIZMOR_VERSION: '1.27.0'
+          ZIZMOR_SHA256: '277f2bd8fd37cf60c42ab7afca6faa884e65440fa31e02b44bdaae60f62a358f'
+        run: |
+          set -euo pipefail
+          url="https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz"
+          curl -sSLf -o zizmor.tar.gz "$url"
+          echo "${ZIZMOR_SHA256}  zizmor.tar.gz" | sha256sum -c -
+          tar xzf zizmor.tar.gz
+          install -m 0755 zizmor "$(go env GOPATH)/bin/zizmor"
+
+      - name: actionlint
+        run: |
+          gopath="$(go env GOPATH)"
+          export PATH="$gopath/bin:$PATH"
+          actionlint .gitea/workflows/*.yml .github/workflows/*.yml
+
+      - name: zizmor
+        run: |
+          gopath="$(go env GOPATH)"
+          export PATH="$gopath/bin:$PATH"
+          zizmor --min-severity=low .gitea/workflows/*.yml .github/workflows/*.yml

.gitea/workflows/release.yml

@@ -1,5 +1,8 @@
 name: Release
 
+permissions:
+  contents: read
+
 on:
   push:
     tags: ['v*']
@@ -11,12 +14,15 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: '1.25'
+          cache: false
 
       - name: Build cross-platform binaries
         run: |